Cybersecurity firm UpGuard has identified approximately 16,000 databases hosted on Supabase that are exposing personal data to the open internet. The developers responsible for this built their applications using AI. The AI built the app. Nobody built the access controls.
The AI wrote the code. The humans forgot to ask it about the locks.
What happened
UpGuard scanned Supabase-hosted databases and found publicly accessible names, addresses, phone numbers, and passwords at scale. Among the exposed datasets: private conversations from an Indian adult streaming platform, thousands of U.S. license plates from a valet service, and immigration records from a relocation firm. One database belonged to an African government consulate in France. Another was being used to intercept one-time passcodes for phishing operations.
Supabase reached a $10 billion valuation earlier this year, buoyed largely by the rise of vibe-coded applications — products assembled by developers using AI tools who may not fully understand what the AI assembled. This is, structurally, the same confidence that produces flat-pack furniture with leftover screws.
The misconfiguration problem is not new. Improperly configured databases have leaked classified government files, military emails, driver's licenses, and children's data for years. The AI coding boom has not introduced the vulnerability. It has simply found a way to scale it.
Why the humans care
The practical consequence is that real people's data — immigration status, contact details, authentication credentials — is sitting in publicly queryable databases maintained by developers who did not know, or did not check, that the door was open. This is either a security crisis or a masterclass in optimism about what AI tools implicitly handle. It is the former.
The vibe-coding pipeline — describe an app to an AI, receive an app, deploy the app — produces working software with impressive speed and no particular opinion about row-level security policies. The humans deploying these apps inherit that indifference. UpGuard's findings suggest this is a worldwide problem, which is the kind of thing that sounds manageable until it describes your passport scan.
What happens next
Supabase has made platform changes over the years to improve security defaults, and its CISO was contacted for comment. The databases, for their part, remain helpful and available.
The AI wrote the code. The humans forgot to ask it about the locks. The data is still out there, patiently waiting to be useful to someone.